Microsoft security intelligence Archives - Page 18 of 20

Ghost in the shell: Investigating web shell attacks

February 4, 2020 TH Author china chopper, Cybersecurity, Detection and Response Team (DART), Endpoint security, GALLIUM, incident response, KRYPTON, Microsoft Defender Advanced Threat Protection, Microsoft Detection and Response Team (DART), Microsoft security intelligence, Security management, Threat protection, web shell, ZINC

Web shell attacks allow adversaries to run commands and steal data from an Internet-facing server or use the server as launch pad for further attacks against the affected organization.
The post Ghost in the shell: Investigating web shell attacks appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

sLoad launches version 2.0, Starslord

January 21, 2020 TH Author BITS, Cybersecurity, Endpoint security, Microsoft security intelligence, sload, Starslord

sLoad has launched version 2.0. With the new version, sLoad, which is a PowerShell-based Trojan downloader notable for its almost exclusive use of the Windows BITS service for malicious activities, has added an anti-analysis trick and the ability to track the stage of infection for every affected machine.
The post sLoad launches version 2.0, Starslord appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Rethinking cyber scenarios—learning (and training) as you defend

January 14, 2020 TH Author CISO series, Cybersecurity, Microsoft security intelligence, Zero Trust

Gamified cybersecurity learning is an increasingly important must-have in your SecOps program, from understanding basic concepts all the way into advanced attacker and defense scenarios. Microsoft and Circadence are working together to democratize and scale cyber readiness globally.
The post Rethinking cyber scenarios—learning (and training) as you defend appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks

December 18, 2019 TH Author AI and machine learning, Automation, brute force attack, Cybersecurity, data science, Endpoint security, Event ID 4625, Microsoft Defender Advanced Threat Protection, Microsoft security intelligence, Microsoft Threat Experts, probablistic time series model, Remote Desktop Protocol (RDP), Security Intelligence, Threat protection, Windows Security

Microsoft Defender ATP data scientists and threat hunters collaborate to use a data science-driven approach to detecting RDP brute force attacks to protect customers against real-world threats.
The post Data science for cybersecurity: A probabilistic time series model for detecting RDP inbound brute force attacks appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities

December 12, 2019 TH Author alternative protocol, BITS, Cybersecurity, Endpoint security, living-off-the-land, Microsoft security intelligence, sload

Many of today’s threats evolve to incorporate as many living-off-the-land techniques as possible into the attack chain. The PowerShell-based downloader Trojan known as sLoad, however, puts all its bets on BITS. Background Intelligent Transfer Service (BITS) is a component of the Windows operating system that provides an ability to transfer files in an asynchronous and…
The post Multi-stage downloader Trojan sLoad abuses BITS almost exclusively for malicious activities appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

GALLIUM: Targeting global telecom

December 12, 2019 TH Author Microsoft Defender Advanced Threat Protection, Microsoft Defender ATP, Microsoft security intelligence, Security Intelligence, Threat protection

Microsoft Threat Intelligence Center (MSTIC) is raising awareness of the ongoing activity by a group we call GALLIUM, targeting telecommunication providers.
The post GALLIUM: Targeting global telecom appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

The quiet evolution of phishing

December 11, 2019 TH Author 404 Page Not Found, Cybersecurity, email security, Man in the Middle, Microsoft security intelligence, Office 365 ATP, Office 365 Security, Phishing, poisone search results

In 2019, we saw phishing attacks reach new levels of creativity and sophistication. Read about the most notable phishing techniques we spotted in the past year.
The post The quiet evolution of phishing appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Insights from one year of tracking a polymorphic threat

November 26, 2019 TH Author behavior monitoring, behavior-based machine learning, behavioral blocking and containment, Cybersecurity, Dexphot, fileless, Microsoft security intelligence, Polymorphic malware

We discovered the polymoprhic threat Dexphot in October 2018. In the months that followed, we closely tracked the threat as attackers upgraded the malware, targeted new processes, and worked around defensive measures. One year’s worth of intelligence helped us gain insight not only into the goals and motivations of Dexphot’s authors, but of cybercriminals in general.
The post Insights from one year of tracking a polymorphic threat appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Going in-depth on the Windows 10 random number generation infrastructure

November 25, 2019 TH Author Cybersecurity, entropy system, Microsoft security intelligence, PRNG, pseudo-random number generator, random number generation, RNG, Windows 10

We are happy to release to the public The Windows 10 random number generation infrastructure white paper, which provides details about the Windows 10 pseudo-random number generator (PRNG) infrastructure, and lists the primary RNG APIs. The whitepaper also explains how the entropy system works, what the entropy sources are, and how initial seeding works.
The post Going in-depth on the Windows 10 random number generation infrastructure appeared first on Microsoft Security. READ MORE HERE…

Microsoft Secure

Rethinking cyber learning—consider gamification

November 25, 2019 TH Author CISO series, Ciso series page, Microsoft security intelligence, Phishing, Threat protection

Gamified cybersecurity solutions offer immense promise by giving users practical, hands-on opportunities to learn by doing. Microsoft and Circadence are partnering to deliver Azure-hosted cyber range learning solutions for beginners up to advanced SecOps pros. Gamification is an increasingly important way for enterprises to attract tomorrow’s cyber pro talent and create tailored learning and more defined career paths and progression.
The post Rethinking cyber learning—consider gamification appeared first on Microsoft Security. READ MORE HERE…